An electric power generating system (EPGS) typically conforms to the structure illustrated in FIG. 1. This structure couples a generator 100 through power feeders 102 to a generator control breaker (GCB) 104. This GCB 104 couples the power generated by the generator 100 to a load bus 106 to which are coupled various utilization equipment. Often, at least a second path to supply power to the load bus 106 is provided to ensure continued supply of electrical energy to the utilization equipment when the generator 100 is not operating. This second path is provided through the bus tie breaker 108 which couples other sources of power via the tie bus 110. The quality of electric power which will be supplied to the load bus 106 is governed in most EPGS's by various standards and specifications. In aerospace applications, for example, the power quality which must be maintained for the utilization equipment is governed by either airframe manufacturer or other industry specifications such as, for example, MIL-STD-704. As shown in FIG. 2, a typical power quality specification defines the acceptable levels and times for which various "abnormal" voltage levels may exist before the system must go off line. Line 126 defines the maximum acceptable voltage envelope, and line 128 defines the minimum acceptable voltage envelope during abnormal conditions. Utilization equipment designers know of these limits and design their power supplies accordingly. Any out of specification performance by the EPGS risks serious damage to many pieces of utilization equipment.
To control the output voltage of the generator 100 within these limits, a generator control unit 112 senses various system parameters such as voltage produced and current supplied by the generator 100, as well as other system status and operational parameters. A voltage regulator 130 within the GCU 112 continually adjusts the generator output to maintain power quality to the utilization equipment. External environmental conditions may require the use of an isolated voltage regulator to ensure proper operation and regulation of the generator output. As an example, voltage regulators used in aerospace applications must operate properly under high electromagnetic interference conditions which may be encountered in flight. An environmental specification, such as FAR/JAR-25 special provisions or DO-160C, defines an operating environment having high intensity radiated fields (HIRF) on the order of 200 volts per meter. In order for the GCU 112 to operate properly in such an environment, various shielding and isolation techniques must be employed in the controller 112 design. One of these techniques requires that the generator output voltage sense inputs must be isolated to preclude the introduction of electromagnetic interference (EMI) within the control unit 112. Such isolation may be provided by, for example, isolation transformers 132, 134, and 136.
To ensure that nothing in the environment, in the voltage regulator 130, or fed back from the utilization equipment will cause sustained out of tolerance performance, a system of protection 138 is also included within the GCU 112. This system of protection 138 will trip the generator 100 off line and open the GCB 104 if the generator output power can no longer be maintained within the acceptable limits of FIG. 2, for example, to preclude any damage to the utilization equipment. If the generator output voltage is too high or too low, the GCU's over voltage or under voltage protection will take the generator 100 off line prior to exceeding a specification limit (line 126 or 128 of FIG. 2). This protection system 138 also provides protection from wiring and other system faults apart from generator output power quality protection.
To ensure maximum system safety and to preclude damage to literally hundreds of pieces of utilization equipment, the GCU 112 is also required to properly protect against performance which exceeds specification limits during multiple failures within the system. Specifically, the GCU 112 is required to provide protection against out of specification performance with one (1) passive fault and one (1) active fault in existence within the EPGS. A passive fault is a failure within the EPGS which does not cause system performance to exceed acceptable limits. A passive fault may also be undetectable and may exist for a significant period of time before it is annuciated to the maintenance crew. An active fault, on the other hand, is one which causes an immediate system disturbance which requires immediate protective action to maintain system performance within specification limits. To satisfy this requirement certain system redundancies and back-up protections are designed into the GCU 112.
A problem meeting this requirement exists, however, for systems utilizing isolated inputs which are required to meet environmental requirements as described above. For these systems, the loss of the generator output voltage sense return line 114 is a passive fault. Because the output voltage of the generator 100 is typically balanced, the voltage on the three phase voltage sense lines 116, 118, and 120 cancel each other at their junction. Since, under normal conditions, no current flows in this neutral line 114, its loss has no immediate system effect and is therefore classified as a passive fault. This fault may introduce a slight variation in output voltage regulation due to slight imbalances in the output voltage phases, but since no out of specification performance occurs, no system action is taken in response thereto. The problem arises if the active fault which occurs during the existence of this passive fault is the loss of one of the generator output voltage sense lines, for example line 116 goes open circuit. Once this occurs, the remaining two input voltages 118, 120 are no longer balanced by the third phase input 116, and form a phase-to-phase circuit as illustrated in FIG. 3. What was originally three individual phase-to-neutral voltage sense signals, in the presence of this passive and active fault, becomes a single phase-to-phase voltage sense signal coupled across two isolation transformer secondaries 122 and 124. Specifically, the GCU 112 senses that the phase with the open sense input 116 is zero volts, and the other two phase voltages, V.sub.sense, are each 1/2 of the phase-to-phase voltage or 0.866 of the actual phase-to-neutral voltage calculated as ##EQU1## where V.sub.phase is the phase-to-neutral voltage.
As a result of this fault, both the voltage regulator control and the system protection logic sense a low average voltage. To compensate for what it believes to be an abnormally low generator output voltage (zero volts for one phase and 99.6 volts for the other two phases (0.866.times.115 Vrms=99.6 Vrms)), the voltage regulator increases the excitation to the generator. In response, the generator output voltage is increased. Typically for an unfaulted system, as the generator output voltage increases, a high phase limiting control will ensure that the voltage regulator does not inadvertently allow any individual phase voltage to exceed a maximum set limit. This control will prevent the voltage regulator from increasing the generator output voltage beyond acceptable limits in the presence of a single phase sense line failure or an open phase in an attempt to maintain the three phase average voltage at 115 Vrms. If this high phase limiter function were not included in the voltage regulator 130, with one phase at zero volts, the other two phases would be increased to 172.5 Vrms ((0 Vrms+172.5 Vrms+172.5 Vrms)/3=115 Vrms). However, since the two phases which are being sensed are only one half of the phase-to-phase voltage, or 0.866 of their normal phase-to-neutral voltage, the high phase limiting control does not limit the voltage regulator 130 at its normal level of 120 Vrms phase-to-neutral, but in fact allows the voltage regulator 130 to increase the generator output voltage to approximately 140 Vrms phase-to-neutral.
While this voltage level is acceptable for a period during abnormal transient conditions, it must, nonetheless, be removed from the load bus 106 in less than two (2) seconds as defined by line 126 of FIG. 2. However, as described above and illustrated in FIG. 3, neither the voltage regulation control 130 nor the system protection 138 can correctly monitor the line-to-neutral output voltage since both must utilize the isolated sense inputs. As a result, the system over voltage protection, which would normally trip the generator 100 off line if the highest output phase-to-neutral voltage exceeds a set threshold for an inverse period of time, does not operate because the voltage level of the highest phase is "thought" to be only 120 Vrms (139 Vrms (actual).times.0.866=120 Vrms). The protection system will trip the generator 100 off line in approximately 10 seconds, however, based on a sensed under voltage fault. This unlikely system trip occurs because the under voltage fault protection system utilizes the average three phase output voltage to determine the presence of an under voltage fault. Here, the absence of one phase input to the GCU 112, due to the opening of line 116, results in a three phase average voltage of less than the under voltage trip threshold, even with the actual elevated generator output voltage. Although the generator 100 is tripped off line after the occurrence of the active fault, an over voltage condition is allowed to exist on the load bus 106 for greater than the period allowed by the power quality specification limits (see line 126, FIG. 2). The result of this passive/active fault combination may be damage to the utilization equipment coupled to the load bus 106 due to the duration of exposure to the high generator output voltage.
This situation becomes even more severe if a second phase sense line, for example line 118 of FIG. 3, goes open circuit. As will be apparent to one skilled in the art, with line 118 open no voltage will be sensed by the isolation transformer secondaries 122 and 124. This will result in zero volts being sensed on all three phases. The voltage regulator will continue to increase the excitation to the generator 100 in an effort to increase the average three phase voltage to 115 Vrms. This increase in excitation will continue until either the exciter driver reaches a current limit or the generator output voltage reaches saturation. In a typical application, the generator output voltage may very well reach 160 Vrms. As described above, this extremely high output voltage will remain connected to the load bus 106 for the duration of the under voltage time delay, currently approximately 10 seconds.
The instant invention is directed at overcoming these problems by tripping the generator off line within the over voltage specification limits during the existence of a passive ground fault and any number of active phase sense input faults which have been heretofore unprotected.